Skill UI

This guide facilitates comprehensive tabletop exercises simulating major ransomware incidents. It systematically tests an organization's preparedness, decision-making processes, and communication protocols across executive, legal, PR, and technical teams. Scenarios cover double extortion, regulatory compliance (GDPR, HIPAA), and varying backup compromise levels, helping organizations identify critical gaps before a real-world attack.

This skill simulates security incidents using discussion-based tabletop exercises for Security Operations Center (SOC) teams. It is designed to test incident response procedures, evaluate cross-functional communication workflows (e.g., Legal, PR, Executive), and assess decision-making capabilities under pressure, all without touching production environments. Ideal for compliance validation, playbook refinement, and comprehensive team training.

A structured framework for performing initial security incident triage. It guides analysts through classifying incident types using established standards like NIST SP 800-61r3, assigning business impact severity (P1-P4), enriching alerts with threat intelligence, and determining containment and escalation paths. Use when SIEM/EDR alerts require human judgment or when coordinating multiple concurrent security events.

A rapid decision-making framework (Observe, Orient, Decide, Act) designed for high-pressure, dynamic environments. It advocates acting on high-probability signals (e.g., 70% confidence) immediately and cycling through observation and action quickly, rather than waiting for perfect certainty. Ideal for incident response, debugging moving targets, and time-bound crisis management.